From eab0079c902a9a52773c6bb63b57555dee45b3ab Mon Sep 17 00:00:00 2001 From: Remi Collet Date: Mon, 15 Jul 2019 14:10:38 +0200 Subject: Fix #78269 password_hash uses weak options for argon2 --- NEWS | 1 + ext/standard/php_password.h | 6 +++--- ext/standard/tests/password/password_needs_rehash_argon2.phpt | 6 ++---- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/NEWS b/NEWS index 1ead981d14..be4b60888f 100644 --- a/NEWS +++ b/NEWS @@ -45,6 +45,7 @@ PHP NEWS - Standard: . Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit). (cmb) + . Fixed bug #78269 (password_hash uses weak options for argon2). (Remi) 27 Jun 2019, PHP 7.2.20 diff --git a/ext/standard/php_password.h b/ext/standard/php_password.h index c7dca73839..ada0c802f2 100644 --- a/ext/standard/php_password.h +++ b/ext/standard/php_password.h @@ -33,9 +33,9 @@ PHP_MINIT_FUNCTION(password); #define PHP_PASSWORD_BCRYPT_COST 10 #if HAVE_ARGON2LIB -#define PHP_PASSWORD_ARGON2_MEMORY_COST 1<<10 -#define PHP_PASSWORD_ARGON2_TIME_COST 2 -#define PHP_PASSWORD_ARGON2_THREADS 2 +#define PHP_PASSWORD_ARGON2_MEMORY_COST (64 << 10) +#define PHP_PASSWORD_ARGON2_TIME_COST 4 +#define PHP_PASSWORD_ARGON2_THREADS 1 #endif typedef enum { diff --git a/ext/standard/tests/password/password_needs_rehash_argon2.phpt b/ext/standard/tests/password/password_needs_rehash_argon2.phpt index 0b5fede1e3..129bed5989 100644 --- a/ext/standard/tests/password/password_needs_rehash_argon2.phpt +++ b/ext/standard/tests/password/password_needs_rehash_argon2.phpt @@ -9,14 +9,12 @@ if (!defined('PASSWORD_ARGON2I')) die('skip password_needs_rehash not built with $hash = password_hash('test', PASSWORD_ARGON2I); var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I)); -var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => 1<<17])); -var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => 4])); -var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['threads' => 4])); +var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST * 2])); +var_dump(password_needs_rehash($hash, PASSWORD_ARGON2I, ['time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST +1])); echo "OK!"; ?> --EXPECT-- bool(false) bool(true) bool(true) -bool(true) OK! -- cgit v1.2.1